Example:
SELECT a.source_ip, b.incident_id, b.incident_code FROM SYMCMGMT.SYMC_IMR_ASSOCIATED_EVENT_VIEW a join symcmgmt.SYMC_IMR_INCIDENT_LIST_VIEW b on a.incident_id=b.incident_id where b.disposition_id=3 and source_ip='10.6.6.20' group by a.source_ip,b.incident_id,b.incident_code

This would list all the incidents (opened and closed), which contain an event with source IP 10.6.6.20.

Just to be clear, an Incident can have multiple source IP's. That means the events which triggered the incident can actually have a different source IP's as origin.

it is probably better to return the reference_num instead of the incident_id, as the reference_num can be found in the SSIm Console when looking at Incidents in the Incidents view.

SELECT a.source_ip, b.reference_num, b.incident_code FROM SYMCMGMT.SYMC_IMR_ASSOCIATED_EVENT_VIEW a join symcmgmt.SYMC_IMR_INCIDENT_LIST_VIEW b on a.incident_id=b.incident_id where b.disposition_id=3 and source_ip='10.6.6.20' group by a.source_ip,b.reference_num,b.incident_code